<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="324">
<package pkgid="1a2f5240f664e764e445e57fec598584dc2e266c8f6a7d67f01ba1591fd1a7d8" name="flightctl" arch="src">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0cee908612f5d5271314b7aaa8339aea3d25acda63dd6af30433627140c49658" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0a0dcae72bde1e5b45adff9c097c32afbd0ba6ac3e50221bdab3e21a3ba07877" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7d4795d4b0b828220c86c8c58b14524a14e61060c4b48810610c0958f5cc68b7" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8204625daa02e2215029e67e4a26922444e13b5a40c1cf5c2ec56f46d94e882a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c61a6942eec6785a1617e060326b2975e5474734328d61089618b675d228bc34" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eb19d77fbeaa7c9323a9c9377bf55176552d5ae308ca4461b952db7a64ee0542" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7322e5dba31ba814f5d77485d5d1d897bb15be3a70c4717c3bc3b8d900414f90" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="72976d0bce5a45288328d43723a215d591f461cdee156cc31f28ba3d79a2f895" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="537aa252eac3e9f521fe3f68a25aca2ee5cc34501b33bc9dbdd7837d72fb0b98" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c4ecfc60ee9bdb7da509069d16780be150a710792f977f32ad4bee847eab1bce" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="83eb5bbb37b4575c42dba7bc8949b6ae1083f7e1da1a477c12dc0b889128fc10" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="639044b3d6b6bd98d1d606429d166cf000aca5575d10dd72ecac01642a5cde7c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="10ea1a056e4b83dfac8bbff1e438d9b5d2bb49efd87ff7fff6a5a21be0a9bd89" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8f38d02f854798403386a3a467b8a31f808943a461b9f4239784233dfeb9acfc" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f4c61128634c46aac9eb65622e8ad232a2aebb6226834435ed9f210fe5c0a9fd" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5f0474744f99f323a8c85e5875322f81146e3458c17eac5d84a6a909d96e625c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e075d3707e6ac2ffc3b6fc8ab35b489df2a8e2a18d71ba9ceeca9964bb24d2ec" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cd1900279519a846e8cb55e4118d5aac0ae9af3b577ea4127956c1f3f5a6e48a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d5c3f24d41825bf73e3a40f966779fdc725204a0b33ebd542cc592b2cd2fd37a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e041b9a9ffb865b899d64971b1de29c2ba727e082dc04df07f7605340b8a9323" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a1304e0f292da5c9195f2dcc4cc737f9feb111b9373f9b73432a9229432a9332" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4f7968fcabadd5b32c75356686d394cb124a378821f1e884765fec5416766c6d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="85d4f53e0de912e0ee87fe04874e756a36c25400688571c89686522cc31c90be" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ee1c509a5faa2da3914401438d80e14355df19f3adb300cff7699d6cfe61c929" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="58410e571ca336733acf7db33b9ce8b80ed7d5d2f704d1d3ffe6ee9f589191f8" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="950823173acc8c990b2609eb9dd010a464c3c053e8afe36309eb9122fa2874b0" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="03bd2686a788dbac570fa436a65d6ba5d24245a8629286e6e1a9d138803974d9" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="62013b4aa0823ac59b4417eb3efd0a9dbeb93e63f4db33cdba8de2e9303aef05" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e10cdfb8dd56a9fc4dfdb09c73cddd36fb7b2e71408938ba9602fc92c60a0310" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="51da7ae7c365d75adebcb95c3b9a24b28d0f9ea15162a1555a86dc62942b7b92" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="436edbeccbeb44f66faa81912979808f284cccb95f1252b2ddf2df2cbf6df939" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bc66fbea134476813a0cd6e0282dc6867620ed7795d80f2205c7133519030f5c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="00e5638565f8d80e874c23f9e7f25f4780733bf600dc594ddeec6362c6810ade" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2899eea5ec4e57fc35e887b55221560a1e88b3d492775e1e93f3e0b4b51d1e28" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="096d0a4d687a57316d9288c4f9cc6e11a6d267ba80564d735ead51f56dccd80d" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0b8c4ea272c1e01ec982b76e820f3835c90f883226794bb8b22b9a6682deb3e1" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f5870b246664b9764728418b14b80a2017b7cf64b6ffeca5a1cea01eae18ebdd" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="393bb45c6ba7bd0b5fe3ec45ee5aa382b42162fffe4e8d2a80c87fba09bbd304" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1d30faf286ff1b875541f126f6606cc81a75a5789522719774c321fe69d59e33" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="671830637e3f08e6e6c43e49c1ada836f3f9962738ad812f989427f806fbb8a1" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b590ab865508ac793bc3c88bd4c19e8795f5c7387b475bb71d88bd4c1fb58c44" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6251a98c209e53696ef8fa5228fb6a31c17f3a6d1a7a85e115049de01d80ff8c" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="14ec40b6b94a6e447683ff13614a378776c819c038370a8339c3210ba92fc835" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d882a3b3014a22655fb017159271bbf0a6cdf0369c394b43de6bf03f3dee519e" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d20fad081a2354cf66cc7784fa34cf6bd9a9294398574eecc5decc26cc8c26d9" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4c39f9845052fbfcb6eb0aac7b14ccd664ff0b5031fbca6530c3abd312e16b23" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="facfeb2ff6bf640c0a2e021ac074cf520e9d2fa1ba02d9d860914476af8b838c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2ed76c0fd4d3138495221502d4b639efbb8245008a55b3dd8925d0019297d85c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5f640f83f5095eee18c7f399b2950e9722294af83ee076d3bb8adb4127f33f67" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ba6ce745005bb1d160f7795415a6af2758d4e988fc1a049286e9863458b79cdb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3b351d297ec51510d4dd3cc25a264d584bdcd40131d5b9ef8c2f663d4e16a514" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2848f8b4bc04d72c4ae4ecb8c5da74ffa057d636b1d9851d3dac41dae119ecff" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fcb7e99518b8e7b58de5dd48ffd19d9ad1a9acfdac532afcf2366a72f5afa68e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8714d5ada864ad1e6d3f9856a46b09db0f6a7c21d0dcdd5945c79efcad2165ef" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d26c709af72c6ce652c2e4346a7610d10ac12c8366074b5b29d6cea22e9993a3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d581d9cbdf59fccb8aa57cf065b3a93bc8d269c4b0b2a22adacdbcdd2a4744ec" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5907fdc39e127762ff6b7d9be52a192663aa1ac0f65f9ec2c90c73ad4e2052c2" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f6089a5148b7adf3743402adb49e47d6fb4f2d8156a7334902bd15288e798b6d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cf63fd8cbe40f10f224d618d86b7f5d1433b672aee15d9597509403dfb0fe6e7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ebf075f272f2b9cdca67ebf7c4c011d646bee6b2eb563836b9c3b14a83539e34" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="53ea48f5255110170f1c8340321b350b4ceaaabfe35b9063941519fdc54759b2" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f26517c5625e52d996a66064488635186e8dbf5fc9e5c62a8b2df72bdb6c6a94" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="513ed5e589ec693380147729599b353d89f2c692def2a32834baf9c38db9eaed" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e6d3693e51d0e1ec1e5209b5ea10edcc361a5fd3ccb871525fa79dcb9e9161d8" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3f87e1a9da20cec4339c9a0714d5128df35ba5337f3d64e26b550fdacec89909" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4c7e8dbde16650c84f93443b4c1c0b7f0e349d8b2ef84d60690adeef3bd8dd4d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9c79d1a7bf299bc338623c2673f8b8101167c7297d460db765bb7b03512cf611" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="83c762a96c6894cce006be56751585255881d5a9e973396303c63a424c830483" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0827eeefd38a9f7da083f874216efd25f684fe26633892ec47667b8bc59a533d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="44759da6d2577c01dc2b196c227d9731c5cd4a23c975dce425727507a5188bc6" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3df5676af138fefe39110e60722dce384fddf65234a997c9c20cbb9e295d51bc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4c66b1f1152494deb324dd852974a111babd2b55f2b63297b1c6ecf1fed8e6b1" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7e33c1b359cf2fdd45c0f9fb937c20ea403505aae0433e11c10d8fbf9f22d7f8" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d72d057d76d11a4c324e02116a32b8747595236d84a4ddd591720da0f76ef8ca" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1b04f96ea6f0e8cc988fe593ef25fed3e466e488a963e802a2f323e199c2727a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4025dc33c6a0eedf5fd7992badd831515edfd720457ca1c9563d571c4e6b0818" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f0b7f760fd1a2afbc8248dabe88f552e110a25fd8655da31c066a9e122bae341" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5e58eb998d29aae01c71a6e640a1d550ae63e0b201e942a725082eb17eb1f6fb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bcf9db193c0c5d7ddc9a0d958bc2b7e095e1a8f4c86d4d4ee96a02ac56ae6dfe" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="771cea763b08a75bfd29521b9fd721761cef0589a867d766ff9d9f49b4da3636" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f9badb2ee6a1bc2afb65c7022e7fe99b7f7dfd2d390919c21b46c16268954109" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6f99db5eb4258381c3de31c084a0874428927b10b1b9751051adbbd424bd62fe" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="423685c7cace492bea7eaafc75afe97ecb5e0100c4ee54b44c57bc05cefb6bd0" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="77dc4ec8d378931a06d50591c408f9fbd79ab38cb0b42185d31b246a62d7debb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="da565d00f3a73cd8c2698fe3d88835285e7f2234c54cfafd117dda1fed601d0c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="15ab814bb1a913ff8d1d21f7df5c727543402dfd000af2f5afc28301632da356" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f0f57e50618dd47770d9a24d08880733aa807d763a1d304b6bb0deef2c0e3dcc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a7fe30ffe93ae1821b91d3233d0d3a4c43184d72359a9448708f00839502fd61" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f502a7486c1cf8a4ec2f9b86e782ace42abb50fedd75668093592554e39ae06e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c15f280ed5ffe815dee98e36f7119ee7a8b219faf5428ef9dec55ef8af050434" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cf36e9f245257b8b3f0d5887b9a5e9b0aac0daf927b2c2bf1cafd976cf768bd7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="7d515efd0e2e3a39549385ca1932af2db06b9cce779c13e55228645abedf4466" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9fa329b31d651acf43b6640549bb27ff9aa7543536703a46f54ac90842fd094b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0b270b4fd50a2d18417937c69ffbd8c1783c5822ae766774ee56e5c1461d0c67" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="641f9dd7fb3b01db1d8305f202951d34e1a7a4d0855b5bb966d51d6cfdc5490f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="df760dcde0adb411a2aa74a622b71340c6a4902c31702a01efaa2f9e433ef192" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4987d61f33b34c9b38730c2f18ea8b2e8f1e8a2c0755b4887aefa6feea6d498a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b73b929a0c1d78f92b5dd8c2f206327a4b2610a24d098fa2ae0897c5108c063e" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d97c3101fd9df3940a0f33adb0fc2a582945a258f912992bfb0e943450c745a5" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ac280d9cc868a3679569d95a5feff92f44566ac4edc7b790da2caad34bd42e5a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bcc2c3077634fc466664ad37f1382b9aab768e22117dc5ada3dd1e5f3b1e506c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3ed1986b4e0f63524a2e2d74c9d43715343e4083d8e7031d899948eae66ffe02" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e25773a95b90759ee3ad2b853b82039c1681b3994e7e2c9d07668680f835a65f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2185aafdc330b709e06377192ee884f3c07a96ad3ddd7f91292ab40c131a0ab0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e0d9c6856597660e631d481d6e90628decfdf0d8e7a31642b981bb287ed6d6ee" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f8517c631f70f4e2fbffcb0759208662cd082b07ca467c8bb375d92006264a98" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="12f93dd27051f5982def13bac499b1799dc14811d9644a2ff229af7c782f34ba" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="747cf226965e48ab7b7a44242213411a2e1295ed61333054fbeb5e37b197d081" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3eadae8a89f5e43f7f3bd415e0a95368b306d982ffce7761825e3508b6cfe58c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="aa8a6b2c6d936f3a67d2b7d136bf8bcc2a278535fb2d5eccb983838bedb1b507" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4ece1c84311e4807ea7496475c0fbc92e71c602a0e56de74083ffdcdaa6e8ff6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="051d2aa6f1689c025ccc45e59b9b81b030094ef5f487bb81fe10b9639c747961" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c88b7a3ff61a70db7b211db463d7dd741a14411bcd6631fb4bdb14133512030b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6c2eb3dc62f3a87219f8bf4b20ec13c24b8cb812466d19c4921c0e1c0a0f1aff" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f26c3d420a0ee87643c1ad2395bb07d59bd25f9cf966ab8b8a0ece5885a0c9e6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="11fc50327cf68887078f37291eec77ffe65aeac9cc889a07dba1233aea566f2b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bf5c532c057a7846ed99797a2a05bc074334e6b08fe5799fb76d03533f5144a9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="401eec2e7e27b9d7fe990d986796faf22b566bd254357676fbd00eb7d4c3a980" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="dec5db5e579dc67568082ef75e613bb08f78f5bfc4dc24ad3b3733c06804806c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d4ad76d8ae557cfd37f56624eb824fa5359f3ca594264571fae8422f7c9a78bf" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="51c34396c6786641b493c246e1eff628b090a850e6f965fd612ce47812892c3b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="20fda959bd20171bf18e36910233f30b068565b810d4319bc6a655cfd21cb6b7" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="38b3528248721b0d7fe3f0479f5ba62f624246ae84f4f336a71ef4f8388ead60" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="89d5aa301a5534f96d54d0e1def5f8aa1bd8d79cecd6997c320dc55e0df7eefd" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cb2d803c630ec1351a2ea8b7790eae3184b444f06da81d51c76811486f16a9d9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5e55538b13e571b59e68387c4437920538dbd403a9d0afd49f748e028d534700" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="08200cab8760015eb985d5926f4e1e2dd8e0fd32bd094e0949cb17e7cb9584b4" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="99fad71b3d18c31e803350777725ac1a1ee3dfa795262ab242de265681d8e0ef" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ed860345fc2a002dbd5411fb8f522d0d35414c0d815c31c383957fdec1b16e15" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1fb2117a62fa4a0bbfbc858ba3c4a1920a90f85a4b3d657978d33300c835980e" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9ed468328b5d61a5f20f459b56ac338db162400a8da91380e4adc78960c62f01" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0e791271a3a361c679335e29956e44775b9ecc30370d12c2043f9a8ca250894d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="89c23611fae9f6ab8ad8b8f7324708af18fb921b3d671c762cc5ba9b83829fe7" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="21a71b02f7eab743c14144344df7c848b96ef367f8986a6ab35ebedba5536355" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="68597b60c55cced181bd421390b83b33327357a0ce2837e0f2827f83809d2921" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="517a3f5a2dd67663874ffc147865d94e07a998b5495258df015536673c88c03b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bf22439592ae372b5c9273aea19cb40c9765cd6c05d10892edbd0bd7b92cc48e" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2291ad3ab7cd1c08d3f247d70d6c5ddf9de96a0631350549ba10febf1d68f4c6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c0e775457a551ed133d8515020f90cb840ed9a7b5244c314908a437f67432679" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ce30d96930c8f66a3f2ed0c0ac9d6d0b2ed7a644105393fede92fddcb7d29295" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="07baaec86c8830e2c9cc0c10898f6f99624df85c51e7cd9876d42c28ab3f2379" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d0325253f85ef175ea031dfc6fad86eefd1611dccaf35bb1592c7baa2b04821d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c7f84200c846e75e101120fb585aed394132ab3851ecc93b67bdfe467dfa51cb" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="553d5ffaed6a523c62bde5b15928e6ef372f36217724d9b1c940e26102da10ed" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="17c26813e13eebdc8a8c35312edc4987fbbd3ff7afd5137fe63a5b366edd6535" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1919db78a674e33f21f5dfad7aade39e395db455a9f91f8bc6782011324115c9" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="add01ea0385703b7c8e19a2033d916bbcf816d68e3e60466aa729609846f7a2e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="21631a2b9cd59b8db3a6c56b48ef1ea75c6bf38ec4c8875ab8637ef62b8a87f7" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a179df115290eb755d7c336bd5622b9da9c4f04979cdbb7fee6eb4f35324e4fc" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e2fe8ec79142b6502debb3d72a2110bfccb985b7d21241d3761ea8abacc19b05" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a9339b2ba148bfd833fbe204062d8ce390d1598e50a3d242094f2d65a7d010bf" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9b53938192881f856543f6d6612eb4d61c00291e710fb6fe37aa018b639ab8f4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3e0959a52a15ae6950983252c3e18474e96c42fd4e814ae570bbee46b2dfe88f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2ad9fb65607c5bd3b432c340e8ef672b3a7541165b0a9afaf8fabd2f081faed4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="00e000dc513bd8e4018963f631a8712ee57689f2b7d7eb0c653fbe9f0efe2b8c" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9e5596d544d3404b1490b3f0046abb36ca48dc6fd28c19a7ecf801628a56a46f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="775141179acbbe308820ff7a2b7297c5103f120d33e3c44e73bb2313636bf30d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3baa080a9931753e879395e7a3fda4f8e5a061e4dfe17d74d6ecc45d775cea7f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="60c27c448559c6433570713f3f18496a040e04df8c044aa5b9dc0a6e6cd3a94e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1a8b247e9cb26e8903212df5e10d4f5328d4162a2784bf8d49fb3855e847cfbc" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6792493bcc99750352e4c8614eb4c3c077cf14a097a8139a3c354c705ab80469" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7bec690200001f13c5dcc2015ecb791ff2083c9d0a5b475a5ffc73ff5adb54eb" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bba15cf1fef5c9aee8bbc57d2704149ca57252bfc4e72957425c33c46c95eb60" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a08b929e29eb525d441f420212f0e7d77f40d16310df5059900ba0487370e68f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="77655822f1a9017535468c94be4faaeb1772d464bdab48b3a74a24047a62b63f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="82639878b8e6e4a7db02c009fe3b876ad4b4cffd6100c5970645d21fc56196d2" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1e46f78e782df87344548c9f1f146456014eac12c506f1e2af4a81b3bf3dc341" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="908df27f65375634cf7ec65ec9b9d8fe5734d281cef56d9a0445d2d8a769021a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c02fb596142f9c09ba7efa1d29d2e3bdecb38d592f269a56fe65d36e1a60b518" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d034b4533cf04e183ff217b7a4e4652c3a5b191292d6a9321a6463f9b49954dc" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8f460d5176b8037ead85817fef7a2adf660ea9d3feb5cdb74d9b0a0af29ec2cb" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e4dda799e1be722d914000102e9420a39cf51b4e21a3d649b9a9e911d7b99e38" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7b1c7e2827e7c2d6499324e7951956bc91e91c80eb38ef453500e3c068fb0b1b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fb4e9b7c8237cfe9dd91a3162a858ffbec19f1e5a790472e1ee57f0780e38f01" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="589b44e2e1fc71cf572655a893a26db2cc13f68e0a92d8ea99e17e2c827ff94f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="491f6b462d6bd1ecec9e05f8c84598c1eb1ebf2bca5aa57cd62a5e4ba6f03b5d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="60c1866d82a02f2bbb5298ec6677d4ff4d5c104d8fb3b24fd27aceb051539494" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f5d6e3f0728740a7ccf201146c5e62d46051b8c41e8d8311a6adc15994174a11" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e764bf15a475f40ca211af385376af46c7803304273fc97904565b7281ba1e48" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="65ab8e84182d15abd465ad58b171edefa68325369867550b1f7fccb963efc667" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="15ff9a9604b4094b7ab182224c5022853e2a2b33090b37664f7ca28142688a1f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="995cfb01bc09a8564532e020c02aa7b8e4b0d62d5a424214ec032f5a9f4a074e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bf10f5879109f3a9673ec04e98d0edfee4dae842f03ea440023178679a5e8acf" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fa5441832d92b07609adcf3cfb9f7dfab24c71655593311015800a28eece7ee6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d74278127a3a8a974a39206fca430d52d747b1c5461f47976988825c8453f48c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="43529ad469e6740d28e21a3dbc72d60d50bde54d6d18444d4ae10cd79287d43b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9abf6e0d6369a467370ab4e16e200c4a98ce6cb7c6b8c0cfa2651f6761bbbf35" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="99bbf75edfd9eb49ffb7cc5131235e19aeddcb217216d3cd1f889d24c2ce1521" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="44501b87a04b66776ab26e92e070bfde962ee241cc864fd08267d763e6947c38" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="579b3a9f056e861f81529ddbcce0c24c8a0e342d1f547585ddac36d35c566826" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ad9658fd5126d14e07c29dd1857cb6498ed03657340ac5bc118e7cd6cae8f485" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="79511a45ede7ec5b03fe98c730b7f6c83fd9ba8287f3c059ca77b281653b16e9" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b2a84ef9d342bf94bc00be127489b0b670f64b2b0154c5392b28263834be88d9" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1e230c59f6640c9d8cf4a31a1c21fe7a869306ccf1d546d6e8cc16e82aa158dc" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b9b4732700489417f1d90bcf383eacba1036adbf005855016734ababaed2852d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3f8260b40ab93671e8d254d555834fd757aaa9d1517a49b2b3155e3be8ab86d2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ed336c3e33b8e28c53938686ccb1f16640f2474f06880da7563fef9d0879071e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7540640fc554180d3afefb810ef6bc8f3a81e59744d1ee68a1662066487c52e7" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="74eca5f24026e8e85bd098f3f4d7fd166249afd44e3c70eb3d6f98b01fa97300" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9ee106bb8b48f0d0b98b816361d50cc11150e93237ed0570351d31b3fa328076" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="16379c6c62e618c85a11bf5c09c758d78dd5b85cf4d8e4c005a10c63e2caa874" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8f46379dabb4bc96e4f5670f38d2a935e5e2f8a6f526580652d5055f94be4d6e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8aa8fac297f1ea5742c3a61dbd90a4bcec8dcd220b6673d51e263d0c308b6ef3" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="396bd2d3b7c806305b47675faa976798ce92d80c5db1140dc1f9ec0e6d499815" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6cb03cb30cbe061f5374bee602c2c796b0fcdb286432109d3f7995a25acf6438" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5149d64bff6b402bc482c93f207278e0d9a553ffce6f0421661b9523c3b8e892" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cf3613425c639683cb6a0fac6770baa76f789a74944e23050a5b61cda78c8f40" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="06714a0c80e4445471740e91595ff34e156b39464e496a5cb551ecd272aff025" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="26ef4b50fc28cb008d06152b61e160d26f447d9fe8c394cbc502cb0c86158a42" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="342a83487177ea9f9195725da5ad180c3ad85a47e68d249846704d427dcc43e4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2dede2a4c068b59c8421129cad5f044763c6acb2444eef5d5954ffff52e73848" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2931e7800eec1e2127b5b45cac94172731cc0488c4c305e140b2832881889851" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="83c9a24ed13d23feaa88415f63e589f6fd41dca5d929c4c666b454c1eb13c5d4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="416b0b190962d6cd3f2a80b00207c9d8fc9af98a3a18a8ac3839f80d2d3a006f" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="878796f0bf24a3cca13ebcd06b98d88bb5908e020ac63b0601a66df0d285a041" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4c1af54a960ac613128a27aed65f40886f3ea6064bfac7adae20fa50a59e43b5" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e5a20203a68a4e9685fba365e2d180079fe8a4a147c7b67bb240770c4b662c63" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b40ffe2d9232a9ee9f75a53b4f4b06f48bc02dd99f416d95b7923afe14169b8d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8224cb019beb9d616ae94782050e078d1278bb6ac57b47c3c9ba5c9732b13cb8" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5c79302a088e1758b91c0e205ddf83161b4b2fa2e6441deee961884e69fb48f3" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="36d75708944041269c479822f597a630913f67dbfceec0e7113fd85f2b161cf0" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="92392d18dabbcbd2f743752acdd6acaf91897f268a78350082e6012980872f13" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4f0252a3d972069755cc636ac429b8a6a4f56f8c649ec29a37a74c6715f47a9a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8e7d0de71ff2434cfbaa116306d53a1331485c9dc05939be886e8ec180223147" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a4a315ebc10c0f48f57b55bb9b5e841571acf26bb15124c25019c1c0abfc304b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="89fe05abd055c0b2bf800b15d8315e5163c1dde0ef0ead8d43eae2fe987aff1e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e27895af34a21e0c5b77beb1d2ba5434e629c804b33b037e1452682bdc50758d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f9220a829e047221e3d008b5563faeff9d97acd880827cc79b78a7cbf28d0445" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="262eb215d795d70a78693b6cae5028648e7dd5cfc2e8a1dc118482f4b33e170a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ac2b5d2da087f976b98ef50cc16b9b6c3b7b278bb086ba43ea6276b856c69697" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="037e7886e878c7bccfcefd99d7cc78191085745e333d477b95a4d5c4de2fabc8" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="91f492e440b5d44371315573f5b724705c1afccc5ca594e06f7a1242017b78be" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d813896f134442f3a26a2ac8446212769b0dd3c5b6258c4050390eac67f58837" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8200245dd73146ba6a7e83a63266ccdea2bf2426fe90b0c831e16abe73da1af5" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0f01dc4cdd71060ac8abb39aa781ff66b9af547d31bffb79220abace8d8de6a1" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c483956916c217bc4691ac9007f894d789e8243fbe94523390f876433c0ad32a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e173076295eee2af12601ab19dad19f6695e7622ad59d3c77d8e88c4a4de5710" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="63e829136f6a923893c734dc6959c3bc7dfd0bd1e1c08a4d8972d7cb25139046" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="94eec51955289495692fd613cf22e0212ad1b5132151823019ab42ccb36bdee7" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4642425ccca169892ee4fbd1ed5898046981698e162cfede01279692c49ad6eb" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ea8a97bbd7105e7d852dee459b17573747b577487b4bb2b06682eb6db9ec00ee" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b11074b2f93b9c2e02c46f53f29ae6422ddb00c6fd39466d3556b245085d2bf3" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eb934337ca41c23a0649c0f57e3206fd0bd8a74b422543a87a87ae9dae2d6660" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="efd541be2ea9c4d1973b5fdb9bb24a842b58a860fc3b736cfde78bdfdae0f49c" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="404af0e9757e28d781d1c50719c297ed97c3566291c51d7a4d8df0983b9d307d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c0cc7e9bfb5f2ed13515f456659590eb58e0f1e9d41389adeb9e1040d8655a5b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a4f491de11273dab714865002eb7bcc638305c658912c2bd4a697ff3339af6cb" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="aa762f6a8b148b4131bed58e04768ed8993f87dea9943407a8a97a5442f2508b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8001b03568cbebb2f630f658275112ef65660dfb6aa0f1aaf8ce9bc772fffbe0" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="300247651253d715294d24b0475899b50b0a3e7c8c7925e9baa5e3de1c32ee49" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e70037c26f9fbdac4007b5de6ab1e4c9bd57e87febff79f3071d3bee6fbe6285" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5ea1d088174755fcfe386ced539e27909114506c8c564a85f877c224ebed189f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="baeeac5fe3d145438285e428f6fdb41bd4da4c8e99aebd20761d4f46a1cb7b0e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1d8d926e176c45bba2b1bc4754a915de974c79b3ef55304535f1024bde07599f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="208d752c6907f87ef3e1f8e85ea208d9463ac754acba08ac428184740ab224ba" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5862ad5eae1af2f41a47fa5626072859b8b2a617cd885287828f127b46902fd0" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7205d30fd5100a54f1971ce6e6619fc1a99cdefaffe2db60f290046b2ec11145" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a6e1350b054def5145071ec022a9d930eca9626ae81f6eeda09333632739b5e7" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8aed09ca6090924e9b8ac586a23d85091d813bf477fdbfe0bcc4b53c127703c3" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bcf0b8b9ca2270e9955a86f1f8155af26217ba9eef22ba5b6519a7018af1d140" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e6ddfda1b7b495866c8099a152b16282aa0cabe2e442d8bd92aaa07e5b361b9d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="dd99e676aa5509fd93f7b77c3b036431c691f97025926ecf20b65c4a8ceebbdf" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eae2dc5dddd09958b02dcbb6d22ea6ec4282834774b1929d76092033926feba2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2e39abb722bb2dcf7f31c0c6e93859126758d3e020d051d4524c858c6813d62b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a46e9ffe8f00b5ab76e065939c2909da39a100164a8a825460bdefb41b555c15" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e26a439d3a024c9f2c49bc3a03ce41df58c6d3a614cd481f450ae5837f96e941" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="090c4f51d04b3e29e47a9d06c66ad242e9c734eeccebcfae5e03d5f6553e1151" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0bae9fdbd121f95459504d713f8e77d6ce0a30fc22459b094350c3fd8ae8d159" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4cee28f85f1b87457956d5707f7957e62c93fd67127084e10754f754cb878b3c" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="60f6efe88b481819bec959ee73e9eff1c21eec77d854fbaa6607fa3d01ba282b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="68af137d994e44dd0dab73bdb3579302622e4a8d0e19fb63f3a7abca8610776a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="843b0e461202977be925acf0c5f0244b5bf5bf337e0623b9891fcbaacb5cc491" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e07731136b4836b1690973b905a5ec61c4bb501d049a7a8d690df12311a1ad45" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="7ea4c766d6de73ffabc202d938d6d50faadd8c4d6d5bdb50289bfc6799acfce9" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2ceafc59f5199049998e9042356ae91903982c7294f193aa662a42c74f51c330" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f5946bc912ce469b2a7fe322179684c98de50914a2bb2927538ffc05a8c7fe1c" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="509e1210c923a167ed5a255cef9d5384d2d9c57c6339e95ea2204c1db7d4ea11" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7ac3d915dab24a4e16c6bc0194cb453191fd8b178a14daa0c4a8c8224e4d7c40" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5861b88634bc56a91d54f3109a44570c0c6a1a061410083b0befe4a4248c4c60" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e4eb4353f44d1e7703dc193920ef6695ef7e68bcfe4d02866342067e55a3a0c4" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="90b4e118612761afd4f8807f07cccdb52259c8b1b0950014d8dd561c185cdbe1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b2f27eccae2b1c773b5b8530085e864493a092827e356db485db1825ad7464bd" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="80ccd1c943de3bb7b2b1ce33a0499a68d904b7ec75dcf2e53ee75667f607b985" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="133c0e8fd4c7c35b0fdeef942fe269fffb8934669eb2102dd9ce73c89f092359" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a4912631e96c18367073ee3d29893d8828c7413414fb5c03cb0d0c9e027c8e09" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bf8c2abb6f10899d73d384f8439ddf5d1b213f2219923f0e8918ca2acef63917" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9ee1b433cf76f04c722a22b3b0718248d42ea71e723d0327fa79429302f6f49b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8c55f82aa0636665c7ae026b5028ad2e093c2bcb79a40d9c98dca3fcf7795c79" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a06eb85210366b8935637e807c82d8dcd7051ce3aa18af57356ec5bf5dbfe076" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bc58edcc1dcac0643180761704bdf4d3941c0bbf7de7a0d9fe35125b5e070fed" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9015ff52ae38fc0764c8db7f71f16c88b155411b2f316f9345bb555353d5647b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8d252710cb0f47a44547808751b0efda3dfbb69ca938a8b3ad0f90daa1e9dc5b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="47b050463f0d20ca26ae4a8ef1629e71a0a4aeb0a02e8f9bcd7389ee3e3bd71f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ee3cb8f0fd73a1ea8b54f3e8fc4d7823e0742ddd7c9b5d64245a89014976de34" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8ad785e5f4653f230d6d70ca115c2fc3f28d3f0b72f226cdfb5bc1c747bb1afc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="31336a99ba694172f9ef92dcdacd4c8f920c4e525e2e323633e01855433cab30" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3478729fe5a85b9763151738b4c607ffbecaf619582e694bcb79d87fbe8fdec1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3aba66d6191b835751b8a89352c51ada15bdd5cda16e40477724727fe17b2d92" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bb3bec3a6e552bd32f66986a04bca150be7d6313c7782f8ba661c753cded9d3d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1685c70b578926f7410b9b896adb9251028636014722efecaf96bbe8e4765e06" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fb4f86e66377aaf8596f4194c6f64b584c7f8bff8a5174ea30b8c3f5aa953793" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="039cad07b009ac449ff7bd16989ed1710c4d9e302a54b0dab0221b720491270a" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b2809b1e870df8d46b3626276d16dff5d7b0c139b856c5607de1bae50e43e289" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="09d50c13ad890bdd79f44f7c4181c4e6b0fe6ef985a5b5455df880494e20c3a5" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="784639bc862be784c5eba230aa54fd67a534c3aaadf8cc8910d695a914ae8511" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1d42ac5ca1a40c78970b70d8c20482182f3c15ffe896ea28cd729ea7a0eb71b5" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4da97c619743e80cef5d5c777f99dc67c9562129f50beec073ff506fb2a0f0de" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="acabce065539e4606e31beeaf1bd28ffecd17fdd1c96b5bc5dd03cd4db1377cc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="13ab14628028fc5f2f0570baff6d1fbdbc438599e4d4463db40c7d5b1d144a99" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1600bafc5bcbe4f39dd0d980954de4ee1d1f9515f2f4f3945369f87a7e02aa26" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8d81046d135e2c4dc03d7e046465a29875a54904b0ea0a1c1fddd15f276a312f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="83a046b8cf4ca86ff898568ecbab528c9ae7f0415f5d536e1afce97ff2b1aaf5" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cd4f21f38f4ede62f40ee10cbc7a954708cbf83d8ddf078efa5de3bcc50a9b2e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="56057eaf4cfb2d78c09c995fb957f4ea3ad3085ee710597fe4b4e495ce14b4ff" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="00dc58902eccb927dab5690a60f6e91742f66e93a63d6d58a91fec1412dd151b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="17028e27cb8f67b3cfd793c2098075112e154a7a3b4eedb275bcb3deb48d2427" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c4aeaf2349928e78724fcefada8d4b6ff50e3905df54b05c6f76e8f081eccf80" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="75fc7440bed8519f629144dfe668dc1c81201a2a59be9e5a3ea7fe84aa3c3e07" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1a52a996743863afbfd0e6d6712dd9b09a0b2a3ddf24fe2ac15e6ec03fb09ce0" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4d6ecbd680472fef124e4f55f712d9088efe12449e476ea6a2e840f3447cb197" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cb56575a3f8630cf65ea905e8aaa45c7018559bca38f07cb0b4d49b1479bfe01" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="aa789973b7971be578338b4115265cdbe83107dcd930b765c5469ffdab87d9bd" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f792fc139099f6ee494959ff4f875633b389c6a263e68740e0871b2d24a16176" name="flightctl-telemetry-gateway" arch="aarch64">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.el10"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
</otherdata>